
Here, \({\mathbf {x}}\)  is an input image, and the goal is to find its perturbed version \(\widetilde{{\mathbf {x}}}\)  that is perceptually similar to \({\mathbf {x}}\)  (encoded by the constraint) but can fool the classifier \(f\)  (encoded by the objective). The loss \({\mathcal {L}}{\cdot ,\cdot }\)  is the margin loss used in [1]}. Both \(f\)  in the objective and \(\phi \)  in the constraint are deep neural networks with ReLU activations, making both the objective and constraint functions NSMT and NCVX. The \(d{{\mathbf {x}},\widetilde{{\mathbf {x}}}}\)  distance is called the Learned Perceptual Image Patch Similarity (LPIPS) [1]}, [3]}. Demo 3 is the PyGRANSO example for solving f3. Note that the codes for data loading, model specification, loss function, and LPIPS distance are not included here. It is almost impossible to derive analytical subgradients for f3, and thus the auto-differentiation feature in PyGRANSO is necessary for solving it.
